Listen to this Post
How the CVE Works
This vulnerability exploits partial state execution in EVM precompiles by intentionally setting low gas limits. When a precompile fails mid-execution due to insufficient gas, partially written state changes persist instead of reverting entirely. Attackers can manipulate this to:
1) Claim rewards without resetting the claimable balance (funds theft).
2) Trigger indeterministic execution, halting validators.
The issue stems from missing atomic state rollback mechanisms in precompile error handling, allowing gas-based failures to leave inconsistent storage.
DailyCVE Form
Platform: evmOS / Cosmos EVM
Version: Pre-patch builds
Vulnerability: Partial state execution
Severity: Critical
Date: YYYY-MM-DD
What Undercode Say:
Exploitation Analysis
- Attackers craft low-gas transactions targeting stateful precompiles (e.g., distribution module).
- Example malicious call:
contract Exploit { function stealRewards(address precompileAddr) public { (bool success,) = precompileAddr.call{gas: 5000}( abi.encodeWithSignature("claim()") ); require(!success, "Atomic revert failed"); } }
Protection Commands
1) Patch validation:
grep -r "RunAtomic" x/evm/ && echo "Patched" || echo "Vulnerable"
2) Upgrade chain with atomic wrapping:
evmosd upgrade apply CVE-2023-XXXX --height [bash]
Code Fixes
Critical diff for manual patching:
// x/evm/statedb.go
+ func (s StateDB) RevertMultiStore(cms storetypes.CacheMultiStore, events sdk.Events) {
+ s.cacheCtx = s.cacheCtx.WithMultiStore(cms)
+ s.writeCache = func() {
+ s.ctx.EventManager().EmitEvents(events)
+ cms.Write()
+ }
+ }
Test Verification
// TestGasAttack in precompiles/distribution
func TestPartialExecution(t testing.T) {
_, err := suite.Precompile.Exec(
suite.CallArgs{Gas: 1000}, // Force OOG
)
require.ErrorContains(t, err, "out of gas")
require.Equal(t, 0, suite.GetClaimable()) // Must be 0
}
Monitoring
Detect attack patterns via:
SELECT COUNT() FROM transactions WHERE gas_limit < [bash] AND to_addr IN (SELECT address FROM precompiles);
Emergency Workaround
Temporary gas floor setting in genesis:
"evm": {
"min_gas_limit": "1000000"
}
Post-Attack Forensics
1) Check journal entries:
evmosd query evm journal [bash] --output json
2) Verify state hashes:
evmosd tendermint verify [bash] [bash]
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
